Alex/add max num uses to tokenhelper v2

sdk/helper/tokenhelper/tokenhelper.go

@@ -38,6 +38,9 @@ type TokenParams struct {
 
 	// The TTL to user for the token
 	TokenTTL time.Duration `json:"token_ttl" mapstructure:"token_ttl"`
+
+	// The maximum number of times a token issued from this role may be used.
+	TokenMaxNumUses int `json:"token_max_num_uses" mapstructure:"token_max_num_uses"`
 }
 
 // AddTokenFields adds fields to an existing role. It panics if it would
@@ -101,6 +104,11 @@ func TokenFields() map[string]*framework.FieldSchema {
 			Type:        framework.TypeDurationSecond,
 			Description: "The initial ttl of the token to generate",
 		},
+
+		"token_max_num_uses": &framework.FieldSchema{
+			Type:        framework.TypeInt,
+			Description: "The maximum number of times a token issued from this role may be used.",
+		},
 	}
 }
 
@@ -167,6 +175,13 @@ func (t *TokenParams) ParseTokenFields(req *logical.Request, d *framework.FieldD
 		return errors.New("'token_ttl' cannot be greater than 'token_max_ttl'")
 	}
 
+	if tokenMaxNumUses, ok := d.GetOk("token_max_num_uses"); ok {
+		t.TokenMaxNumUses = tokenMaxNumUses.(int)
+	}
+	if t.TokenMaxNumUses < 0 {
+		return errors.New("'token_max_num_uses' cannot be negative")
+	}
+
 	return nil
 }
 
@@ -179,6 +194,7 @@ func (t *TokenParams) PopulateTokenData(m map[string]interface{}) {
 	m["token_policies"] = t.TokenPolicies
 	m["token_type"] = t.TokenType.String()
 	m["token_ttl"] = t.TokenTTL.Seconds()
+	m["token_max_num_uses"] = t.TokenMaxNumUses
 }
 
 func (t *TokenParams) PopulateTokenAuth(auth *logical.Auth) {
@@ -190,6 +206,7 @@ func (t *TokenParams) PopulateTokenAuth(auth *logical.Auth) {
 	auth.Policies = t.TokenPolicies
 	auth.TokenType = t.TokenType
 	auth.TTL = t.TokenTTL
+	auth.NumUses = t.TokenMaxNumUses
 }
 
 const (

vault/token_store.go

@@ -397,6 +397,12 @@ func (ts *TokenStore) paths() []*framework.Path {
 				Description: "(DEPRECATED) Use 'token_bound_cidrs' instead. If this and 'token_bound_cidrs' are both specified both will be retained but 'token_bound_cidrs' will take precedence.",
 				Deprecated:  true,
 			},
+
+			"token_max_num_uses": &framework.FieldSchema{
+				Type:        framework.TypeInt,
+				Description: "The maximum number of times a token issued from this role can be used",
+				Deprecated:  true,
+			},
 		},
 
 		Callbacks: map[logical.Operation]framework.OperationFunc{
@@ -409,7 +415,7 @@ func (ts *TokenStore) paths() []*framework.Path {
 		ExistenceCheck: ts.tokenStoreRoleExistenceCheck,
 	}
 
-	tokenhelper.AddTokenFieldsWithAllowList(rolesPath.Fields, []string{"token_bound_cidrs", "token_explicit_max_ttl", "token_period", "token_type", "token_no_default_policy"})
+	tokenhelper.AddTokenFieldsWithAllowList(rolesPath.Fields, []string{"token_bound_cidrs", "token_explicit_max_ttl", "token_period", "token_type", "token_no_default_policy", "token_num_uses"})
 	p = append(p, rolesPath)
 
 	return p
@@ -2234,6 +2240,16 @@ func (ts *TokenStore) handleCreateCommon(ctx context.Context, req *logical.Reque
 			renewable = false
 		}
 
+		// Update num_uses which is equal to req.Data["num_uses"] at this point
+		// 0 means unlimited so 1 is actually less than 0
+		switch {
+		case role.TokenMaxNumUses > 0 && te.NumUses == 0:
+			te.NumUses = role.TokenMaxNumUses
+		case role.TokenMaxNumUses < te.NumUses:
+			te.NumUses = role.TokenMaxNumUses
+		default:
+		}
+
 		if role.PathSuffix != "" {
 			te.Path = fmt.Sprintf("%s/%s", te.Path, role.PathSuffix)
 		}
@@ -2969,6 +2985,7 @@ func (ts *TokenStore) tokenStoreRoleRead(ctx context.Context, req *logical.Reque
 			"path_suffix":            role.PathSuffix,
 			"renewable":              role.Renewable,
 			"token_type":             role.TokenType.String(),
+			"token_max_num_uses":     role.TokenMaxNumUses,
 		},
 	}
 
@@ -3149,6 +3166,12 @@ func (ts *TokenStore) tokenStoreRoleCreateUpdate(ctx context.Context, req *logic
 		}
 	}
 
+	// no legacy version without the token_ prefix to check for
+	tokenMaxNumUses, ok := data.GetOk("token_max_num_uses")
+	if ok {
+		entry.TokenMaxNumUses = tokenMaxNumUses.(int)
+	}
+
 	// Run validity checks on token type
 	if entry.TokenType == logical.TokenTypeBatch {
 		if !entry.Orphan {